Characterizing and Mitigating the Effects of Device Temperature on RF Fingerprinting Accuracy
Source: arXiv:2607.25070 · Published 2026-07-27 · By Haytham Albousayri, Bechir Hamdaoui
TL;DR
Radio Frequency Fingerprinting (RFFP) methods leverage hardware-induced signal impairments to uniquely identify wireless devices. However, existing approaches largely ignore the significant impact of device temperature on the extracted radio fingerprints. Temperature variations affect hardware impairments such as carrier frequency offset (CFO), causing notable degradation in classification accuracy when models trained at one temperature are tested at another. This paper addresses this major gap by proposing a temperature-aware deep learning framework for RFFP that explicitly incorporates real-time device temperature as an input feature during inference. This enables the model to adapt to continuous temperature variations and generalize better to unseen temperature conditions.
The authors validate their method on a comprehensive real-world Bluetooth Low Energy (BLE) dataset collected from 12 ESP32-C3 devices at three different locations and under line-of-sight and non-line-of-sight scenarios. Their temperature-aware approach outperforms both temperature-unaware baselines and temperature-invariant methods that remove CFO components, with classification accuracy improvements exceeding 60% under large and unseen temperature variations. The proposed CNN-based model sustained over 97% accuracy across a wide continuous temperature range, compared to as low as 40% for temperature-unaware models in cross-location and temperature-shifted tests. This work establishes strong empirical evidence that incorporating continuous temperature measurements directly into RFFP classification is an effective strategy for mitigating temperature-induced signature drift.
Key findings
- Incorporating real-time device temperature as an input feature boosts classification accuracy by over 60% compared to temperature-unaware baselines on the BLE dataset across all tested temperature and domain shifts.
- Temperature-unaware RFFP accuracy can drop from ~90% to 40% when tested on signals with temperature outside the training range (52–56°C), while the temperature-aware model maintains >97% accuracy (Fig. 9a).
- Temperature-aware approach generalizes better across locations (Loc1, Loc2, Loc3), with accuracy declines of only ~5% under cross-location tests, compared to drops of 30–70% for other baselines (Figs. 9-11).
- Carrier frequency offset (CFO), a critical hardware impairment for RFFP, strongly correlates with temperature and varies continuously, motivating the continuous temperature input instead of discrete temperature-specific models (Fig. 1b).
- CNN architecture outperforms Transformer, GRU, and LSTM models in BLE RFFP classification accuracy and inference efficiency for the temperature-aware scenario (Fig. 8 and Table I).
- Temperature-invariant baseline that removes CFO before classification only partially mitigates temperature effects and performs substantially worse than temperature-aware models.
- Collecting only 3 minutes of training data during device warm-up (covering 30°–52°C) suffices for the temperature-aware model to generalize well to later steady-state higher temperatures up to 56°C in test data.
- Transmitting measured temperature OTA embedded in BLE advertisement payload is feasible and effective for real-time temperature-aware RFFP.
Threat model
The adversary is an unauthorized wireless device attempting to impersonate a legitimate device via RF fingerprint spoofing. They do not have the ability to forge or manipulate the device's internal temperature measurement transmitted OTA, nor can they alter the hardware impairments directly. The system assumes access to real-time temperature data accurately reflects the device internal conditions, which the adversary cannot falsify or hide.
Methodology — deep read
The paper tackles the challenge that device temperature variation significantly alters RF fingerprints, degrading classification accuracy.
Threat Model & Assumptions: The adversary is a wireless attacker or unauthorized device attempting to impersonate a legitimate transmitter. The authentication system relies solely on identifying unique hardware impairments in RF signals, assuming devices can report their real-time internal temperature transmitted openly.
Data: The authors collected a large real-world BLE dataset using 12 ESP32-C3 devices transmitting advertisement frames with embedded temperature info over three distinct locations/environments: LoS at 1.5m (30 dB SNR), NLoS with metal obstruction at 1.5m (20 dB SNR), and LoS at 7.5m in a multipath fading environment (18 dB SNR). I/Q samples were captured at 6 MS/s for 20 minutes per device, yielding ~33,000 frames per device, shaped as (33,000, 2, 256) tensors representing IQ samples normalized and synchronized across devices. Only the first 3 minutes (~5000 samples) were used for training, validated on 10%, and 20% held out for offline testing, simulating generalization to unseen temperatures and time.
Architecture / Algorithm: The RFFP model is based on 1D convolutional neural networks (CNN) with 5 convolutional blocks (filter sizes 32 to 384, kernel sizes decreasing from 48 to 3), followed by batch norm, LeakyReLU, max pooling. The CNN extracts temporal features from raw IQ samples. The resulting flattened feature vector is concatenated with a scalar temperature input extracted from payload, then passed through an MLP head with layers of 1024, 512, and K neurons (K=number of devices) with ReLU and dropout applied. Output is the softmax probability over device identities. This allows the model to jointly learn temperature-conditioned feature representations.
Training Regime: Models were trained with 10 different random seeds for stability. Training used frames from the initial 3 minutes covering device warm-up temperatures 30°C to 52°C. The evaluation tested models on frames captured up to 20 minutes, including unseen temperatures 52°C to 56°C, assessing temporal generalization. Training batch size, optimizer details, and epochs were not explicitly detailed.
Evaluation Protocol: Accuracy (classification rate) was the core metric. Cross-location (Loc1, Loc2, Loc3) and temporal shifts were tested to study robustness. Baselines included temperature-unaware RFFP (raw IQ without temp input) and temperature-invariant RFFP (IQ input with CFO/phase offset removal). The proposed method’s performance was compared against these. Experiments explored domain shifts in temperature and location independently. Execution times for training and inference were measured for model efficiency.
Reproducibility: The BLE dataset and code were publicly released on the authors’ website for benchmarking and replication. The paper provides extensive architecture and dataset details allowing reimplementation.
One end-to-end example: Frames were collected from device Tx1 at Loc1 during warm-up (temperature rises from 30°C to 56°C). The model is trained using frames from 0-3 minutes (temp 30°C to 52°C) concatenated with temperature features extracted from payload. At test time, frames from 3-20 minutes (temp 52°C to 56°C) are input with temperature values. The temperature-aware CNN correctly identifies device Tx1 with >97% accuracy despite unseen temps, outperforming baselines which drop below 40% accuracy.
Technical innovations
- Incorporation of continuous real-time device temperature as an additional input feature in RF fingerprinting deep learning models to capture temperature-dependent hardware impairments.
- Design of a BLE payload structure embedding device-internal temperature measurements allowing over-the-air temperature sharing for temperature-aware authentication.
- Use of a CNN-based architecture concatenating temperature scalar with learned IQ signal embeddings to improve generalization under large unseen temperature shifts.
- Comprehensive evaluation of temperature effects on major RF impairments like CFO, demonstrating strong correlation with temperature rather than location, motivating temperature-aware features.
Datasets
- BLE-device-temperature — ~396,000 frames total from 12 ESP32-C3 devices — collected in three locations (Loc1, Loc2, Loc3), public at https://research.engr.oregonstate.edu/hamdaoui/datasets
Baselines vs proposed
- Temperature-Unaware RFFP: accuracy drops from ~90% to 40% on unseen temperature range 52–56°C; Temperature-Aware RFFP: accuracy remains >97% (Fig. 9a)
- Temperature-Invariant RFFP (residual CFO removal): accuracy drops from 90% to ~60% under temperature shifts vs Temperature-Aware 97+%
- CNN model: inference time ~0.47 ms, training time ~2.7 ms per step; Transformer inference 0.54 ms, training 5.3 ms; GRU inference 0.64 ms; LSTM inference 0.75 ms, favoring CNN (Table I)
- Cross-location testing: Temperature-Unaware accuracy degrades by approx 50% or more vs Temperature-Aware accuracy degrades <5% (Figs. 9-11)
Figures from the paper
Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.25070.
Fig 5: Proposed Training Pipeline.
Fig 6: Experimental testbed and hardware configuration.
Fig 7: shows the average temperature of all Tx devices
Fig 8: RFFP classification accuracy when training at first three
Fig 9: Accuracy vs. Time/Temperature when training at Loc1.
Fig 2: Overview of our RFFP system.
Fig 3: Designed BLE frame.
Fig 4: Proposed temperature-aware RFFP framework.
Limitations
- Training was limited to 3 minutes of warm-up data per device, possibly insufficient for modeling all temperature dynamics in longer deployments.
- The experiments focused solely on BLE (ESP32-C3) devices, so generalization to other RF technologies and hardware is not demonstrated.
- Adversarial or spoofing attacks against temperature reporting were not studied; the approach relies on accurate OTA temperature info.
- Only classification accuracy was evaluated; robustness to sophisticated adversarial scenarios or real-time adversary interventions was not assessed.
- Training, validation, and testing splits were static and no explicit distribution shift beyond temperature and location changes was tested (e.g., channel variation).
- Details on exact training hyperparameters (optimizer, learning rate, batch size) and regularization tuning were sparse, potentially hindering direct reproducibility.
Open questions / follow-ons
- How robust is the temperature-aware approach against attackers who can spoof or manipulate the temperature metadata embedded in the payload?
- Can the temperature-aware modeling framework be extended to include other environmental or device-state variables beyond temperature (e.g., humidity, supply voltage)?
- What is the impact of channel variation combined with temperature shifts on RFFP, and can joint multi-domain adaptation be effectively performed?
- How does the accuracy scale when more devices or device models with varying hardware characteristics are included?
Why it matters for bot defense
For bot-defense and CAPTCHA practitioners relying on RF fingerprinting for device authentication, this paper highlights a critical environmental factor—device temperature—that can dramatically degrade classification accuracy if ignored. The demonstrated temperature-aware framework shows how incorporating real-time internal device temperature as an additional input feature enables robust fingerprinting across broad continuous temperature ranges and environmental changes, reducing false negatives caused by temperature-induced fingerprint variation.
Practitioners should consider augmenting RF fingerprinting pipelines with auxiliary sensor metadata (like temperature) transmitted in-band or out-of-band to improve resilience to natural device and environmental state variations. This is especially important in real-world scenarios where devices experience dynamic thermal conditions that otherwise cause signature drift and misclassification. The paper provides a practical data collection and modeling blueprint for integrating temperature awareness into deep learning classifiers, applicable to BLE and likely other wireless technologies, enhancing the reliability of device authentication defenses against bot or impersonation attacks.
Cite
@article{arxiv2607_25070,
title={ Characterizing and Mitigating the Effects of Device Temperature on RF Fingerprinting Accuracy },
author={ Haytham Albousayri and Bechir Hamdaoui },
journal={arXiv preprint arXiv:2607.25070},
year={ 2026 },
url={https://arxiv.org/abs/2607.25070}
}